ClawHub

11111

Security checks across malware telemetry and agentic risk

Overview

This is a narrow read-only UAPI helper for listing AI translation language/configuration options, with some overly broad routing wording but no hidden code or unsafe behavior.

Install this only if you want an agent to use uapis.cn for AI translation language/configuration lookups. Be aware that broad trigger words may select it for some unrelated language or translation requests, and provide a UAPI key only when you intentionally want authenticated quota for this specific endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The quick-start text overstates the skill as suitable for generic 'AI translation' tasks even though it only wraps a single language/config discovery endpoint. In an agent setting, this can cause incorrect tool selection, misrouting user requests, and disclosure of irrelevant request metadata to the wrong endpoint, which is a real security and safety issue because capability confusion can degrade least-privilege behavior.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger keyword set includes the generic term "languages," which is broad enough to match many unrelated user intents involving programming languages, human languages, or general translation questions. In an agentic routing context, this can cause incorrect tool selection and unintended API calls, especially because this skill is for a single narrow endpoint that only returns AI translation language configuration.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrase says to select the skill when the user wants 'AI translation configuration' work, but it does not clearly exclude adjacent intents like actual translation, language detection, or broader translation workflows. That ambiguity can cause an agent to invoke this skill for unrelated requests, increasing the chance of incorrect external calls and accidental sharing of user-supplied content with an endpoint that does not need it.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The keyword list contains broad terms like 'languages' and 'ai translation,' which are likely to collide with many normal translation requests unrelated to this endpoint. In an automated agent workflow, such broad matching can systematically route user requests to the wrong skill, causing workflow failure and unnecessary exposure of prompts or text content to an endpoint intended only for language/config listing.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal